The free world is the new continent in cyberspace that we have built so we can live here in freedom. It's impossible to live in freedom in the old world of cyberspace, where every program has its feudal lord that bullies and mistreats the users. So, to live in freedom we have to build a new continent. Because this is a virtual continent, it has room for everyone, and there are no immigration restrictions. - Richard Stallman -

If you’ve installed sysstat from source, the default location of sa1 and sa2 is /usr/local/lib/sa. If you’ve installed using your distribution update method (for example: yum, up2date, or apt-get), this might be /usr/lib/sa/sa1 and /usr/lib/sa/sa2.

This runs close to midnight (at 23:53) to create the daily summary report of the sar data.

sa2 creates /var/log/sa/sarXX file (Note that this is different than saXX file that is created by sa1). This sarXX file created by sa2 is an ascii file that you can view it in a text editor.

This will also remove saXX files that are older than a week. So, write a quick shell script that runs every week to copy the /var/log/sa/* files to some other directory to do historical sar data analysis.

II. 10 Practical Sar Usage Examples.

There are two ways to invoke sar.

sar followed by an option (without specifying a saXX data file). This will look for the current day’s saXX data file and report the performance data that was recorded until that point for the current day.

sar followed by an option, and additionally specifying a saXX data file using -f option. This will report the performance data for that particular day. i.e XX is the day of the month.

In all the examples below, we are going to explain how to view certain performance data for the current day. To look for a specific day, add “-f /var/log/sa/saXX” at the end of the sar command.

All the sar command will have the following as the 1st line in its output.

$ sar -uLinux 2.6.18-194.el5PAE (dev-db) 03/26/2011 _i686_ (8 CPU)

Linux 2.6.18-194.el5PAE – Linux kernel version of the system.

(dev-db) – The hostname where the sar data was collected.

03/26/2011 – The date when the sar data was collected.

_i686_ – The system architecture

(8 CPU) – Number of CPUs available on this system. On multi core systems, this indicates the total number of cores.

1. CPU Usage of ALL CPUs (sar -u)

This gives the cumulative real-time CPU usage of all CPUs. “1 3″ reports for every 1 seconds a total of 3 times. Most likely you’ll focus on the last field “%idle” to see the cpu load.